Grafana Vulnerabilities and Affected Products
Vulnerabilities associated with grafana/grafana-enterprise.
Products
Clear product- grafana59 vulnerabilities
- Grafana OSS21 vulnerabilities
- Grafana Enterprise16 vulnerabilities
- grafana/grafana4 vulnerabilities
- grafana/grafana-enterprise4 vulnerabilities
- Tempo3 vulnerabilities
- Enterprise Traces (GET)2 vulnerabilities
- Grafana MCP Server2 vulnerabilities
- grafana-image-renderer2 vulnerabilities
- grafana_enterprise2 vulnerabilities
- Loki2 vulnerabilities
- agent1 vulnerability
- Agent Flow1 vulnerability
- agent_flow_windows1 vulnerability
- Alloy1 vulnerability
- google-sheets-datasource1 vulnerability
- Grafana Alerting1 vulnerability
- Grafana Correlations1 vulnerability
- Grafana IRM1 vulnerability
- Grafana Operator1 vulnerability
- grafana-csv-datasource1 vulnerability
- grafana-infinity-datasource1 vulnerability
- grafana-json-datasource1 vulnerability
- grafana-zabbix-plugin1 vulnerability
- mcp-grafana1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-41117MEDIUM | XSS in Grafana Explore stack traceStack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever. CWE-79Feb 12, 2026 | CVSS6.8v3.1 | EPSS0.239% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-21722MEDIUM | Public Dashboards time range restriction on annotations can be bypassedPublic dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any annotations that would not otherwise be visible on the public dashboard. | CVSS5.3v3.1 | EPSS0.327% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-21721HIGH | Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege EscalationThe dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation. | CVSS8.1v3.1 | EPSS0.647% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-21720HIGH | Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time outEvery uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems. | CVSS7.5v3.1 | EPSS0.618% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |